mistral.rs Media Loader: Unauthenticated SSRF and arbitrary local file read via image_url

Published September 10, 2026 GHSA-wfgq-w7cq-qj7j

mistral.rs can make internal service requests and reveal whether local server files exist. It can also tie up workers with large or nonresponsive requests.

Severity
HighCVSS 7.2
Fix
Fixed in 0.8.18Fix recorded yesterday
Affected versions
0.8.17 or older
Affects
mistralrs-server-core

How it works

  • The server accepts image and audio locations from incoming requests.
  • It fetches network addresses without checking their destinations, including internal services.
  • It also opens existing local paths and returns different errors for existing and missing files.
  • Unbounded or nonresponsive requests can tie up server workers.

What to do

Check the installed mistralrs-server-core version and compare it with the GitHub advisory. Versions 0.8.17 or earlier are within the affected range.

Upgrade mistralrs-server-core to version 0.8.18.

Technical details

Affected software: mistralrs-server-core

The issue affects request-time image_url and audio_url handling in mistralrs-server-core. Server-side requests can reach attacker-selected internal destinations, while local-path handling provides file-existence and file-type checks rather than file contents.

References

View Original Source